Curated tips on Kubernetes hardening, CI and supply-chain gating, API security, and AI-assisted fuzzing. Practical field notes from real infrastructure.
Cyber Resilience Act reporting starts 11 September 2026. Ten tips for the 24-hour clock, naming the right coordinating CSIRT, and a platform with no API.
Read more: Cyber Resilience Act Reporting: 10 Tips for Sept 11OWASP renumbered 8 of 10 LLM risks in 2026: LLM06 is no longer Excessive Agency. Grep your policies for bare IDs and remap them in an afternoon.
Read more: OWASP LLM Top 10 2026: Fix Your Crosswalk, 8 IDs MovedSet kube-proxy mode explicitly before Kubernetes 1.40 disables IPVS: nftables drops NodePort on secondary node IPs and silences your sync-failure alert.
Read more: kube-proxy IPVS to nftables: Fix 11 Traps in 1.40Run these 12 checks before helm upgrade to Cilium 1.19: ClusterMesh policy scoping flips, BGPv1 CRDs are gone, and five service flags vanish.
Read more: Cilium 1.19 Upgrade: Fix 12 Traps Before BGP DropsStop npm 12 from skipping native builds: 12 tips to tell Cannot find module build/Release from a missing optional dep.
Read more: Fix "Cannot find module build/Release" After npm 12Pin your pnpm version first, then run one grep: pnpm 12's Rust CLI turns a pnpm-workspace.yaml typo into ERR_PNPM_UNRECOGNIZED_WORKSPACE_SETTINGS.
Read more: pnpm 12 Upgrade: Fix 12 Rust CLI Traps Before CI BreaksMove Kubernetes off non-expiring ServiceAccount secrets to bound, projected tokens via the TokenRequest API, and fix the 401s the migration triggers.
Read more: Bound ServiceAccount Tokens: 9 Tips to Kill Static OnesWire GitHub Actions OIDC to AWS correctly: scope the sub claim, handle the July 15 immutable-claim change, and avoid the trust policy traps tutorials skip.
Read more: GitHub Actions OIDC to AWS: Drop Static Keys for GoodBattle-tested agentic SOC tips: gate autonomy on 90% shadow-mode concordance, split verdict from action, and treat every log line as attacker-authored.
Read more: Agentic SOC in 2026: 10 Tips for Safe TriageOSS-Fuzz-Gen, Buttercup, and Atheris run on a laptop with one LLM key. Ten practical commands to fuzz your own repo before attackers do.
Read more: Run AI Fuzzing on Your Own Repo Before Attackers DoPgDog sits in front of unmodified Postgres as a pooler, read/write balancer, and sharder. Here are the sharp edges to map before it hits production traffic.
Read more: PgDog: Connection Pooling, Read Splits, and ShardingBattle-tested OWASP API Security Top 10 tips for 2026: hunt shadow and zombie APIs at runtime, test BOLA in CI, and close the gaps that breached Optus.
Read more: OWASP API Top 10: Shadow APIs and BOLA Tips for 2026Why LLM agent guardrails fail under adaptive attack, and the architectural patterns that actually contain prompt injection in 2026.
Read more: Prompt Injection Defense: 10 Tips That Hold UpBattle-tested Kubernetes hardening for 2026: enforce Pod Security Standards, fix over-permissive RBAC, default-deny networking, and mitigate the CVEs nobody will patch.
Read more: Kubernetes Hardening 2026: RBAC, PSS & Unfixed CVEsHow to discover, scope, and govern service accounts, API keys, tokens, and AI agents before machine credentials become your breach path.
Read more: Non-Human Identity Governance: Field Tips for 2026Deep dives into infrastructure, security, and technical leadership. No noise, just engineering rigor. Subscribe and grab the infrastructure security checklist I work from.
Indra G. Prasetya
